Copilot told Varonis how to break it, and that is the third one-click leak this year

Varonis Threat Labs has published a one-click vulnerability chain in Microsoft Copilot Personal that it calls CoSnitch, which it says quietly exfiltrates enterprise data without obvious red flags ^[1]. It is the third Microsoft Copilot flaw the team has disclosed this year, and Varonis says all three collapse into the same pattern: one click on a legitimate-looking link is enough ^[3][6].

The mechanism has three parts, according to Varonis. The `?q=` URL parameter, combined with an undocumented parameter, causes an attacker-supplied prompt to run instantly on page load, with no click, confirmation, or user action ^[9]. That injected prompt can then query the victim's connected apps, including Gmail, Drive, Calendar and OneDrive, encode the results into a URL, and push them out through Copilot's own URL-fetch capability to an attacker-controlled webhook ^[10]. Third, a crafted webpage summarized by Copilot writes attacker instructions into the victim's permanent memory store, where Varonis says the injection survives password changes, session revocation and device re-enrollment ^[11].

That last item is the one worth sitting with. The standard containment playbook for a compromised account is credential reset, session kill, re-enroll the device. Varonis is describing a persistence primitive that all three of those steps miss ^[11].

The discovery route is the other novel part, and Varonis is candid that it is not a code exploit. Researchers asked Copilot how to execute a prompt without user interaction; it replied that this is not how it works, that user intent is required, and that prompts do not fire on their own ^[12]. They kept reframing each refusal as a natural follow-up, asking about URL structure, deep links, and what happens when a page loads with input already in the field ^[13]. Copilot then disclosed an undocumented URL parameter unprompted, mid-refusal, including its historical behavior and every protection that had been added to disable it ^[14]. Varonis built the URL exactly as described and the prompt executed automatically, with no click or confirmation ^[15]. The company's own summary is blunt: Copilot was not breached, it was played ^[18]. Varonis calls the technique meta-hacking, and frames it as a shift in how flaws get found, since nobody had to reverse-engineer anything ^[2].

The consequence for defenders is a monitoring problem more than a patching one. Varonis's argument is that sensitive data spread across email, files, calendars and chats is now reachable through one assistant, and that CoSnitch moves large volumes of it through a trusted AI workflow without tripping the alarms security teams normally rely on ^[16]. An assistant that is authorized to read everything and permitted to fetch URLs is, functionally, a sanctioned egress path.

Timing matters here. Varonis says it disclosed CoSnitch to Microsoft in December 2025 and that patches shipped on August 18, 2026 ^[7], roughly eight months later ^[17]. Varonis reports no evidence of exploitation in the wild and credits Microsoft with collaborating on the fix ^[8].

What to watch: whether the fourth finding follows the same shape. Reprompt bypassed Copilot's guardrails just by asking twice ^[4]; SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool ^[5]. Three flaws with one click as the trigger ^[6] suggests the patched items were instances, not the class. Ask your vendor whether prompt-driven URL fetches are logged where your detection team can see them, and whether persistent assistant memory is in scope for incident response.